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Executive Summary 

Overview 

In India, an inability to prove identity is one of the biggest barriers preventing the poor from 
accessing benefits and subsidies. Public as well as private sector agencies across the country 
typically require proof of identity before providing individuals with services. But till date, there 
remains no nationally accepted, verified identity number that both residents and agencies can use 
with ease and confidence. 

As a result, every time an individual tries to access a benefit or service, they must undergo a full 
cycle of identity verification. Different service providers also often have different requirements in 
the documents they demand, the forms that require filling out, and the information they collect on 
the individual. 

Such duplication of effort and 'identity silos' increase overall costs of identification, and cause 
extreme inconvenience to the individual. This approach is especially unfair to India's poor and 
underprivileged residents, who usually lack identity documentation, and find it difficult to meet 
the costs of multiple verification processes. 

There are clearly, immense benefits from a mechanism that uniquely identifies a person, and 
ensures instant identity verification. The need to prove identity only once will bring down 
transaction costs for the poor. A clear identity number would also transform the delivery of social 
welfare programs by making them more inclusive of communities now cut off from such benefits 
due to their lack of identification. It would enable the government to shift from indirect to direct 
benefits, and help verify whether the intended beneficiaries actually receive funds/subsidies. 

A single, universal identity number will also be transformational in eliminating fraud and 
duplicate identities, since individuals will no longer be able to represent 

themselves differently to different agencies. This will result in significant savings to the state 
exchequer. 

The UIDAI - evolving an approach to identity 

The Government of India undertook an effort to provide a clear identity to residents first in 1993, 
with the issue of photo identity cards by the Election Commission. Subsequently in 2003, the 
Government approved the Multipurpose National Identity Card (MNIC). 

The Unique Identification Authority of India (UIDAI) was established in January 2009, as an 
attached office to the Planning Commission. The purpose of the UIDAI is to issue a unique 
identification number (UID) to all Indian residents that is (a) robust enough to eliminate duplicate 
and fake identities, and (b) can be verified and authenticated in an easy, cost-effective way. The 
UIDAI's approach will keep in mind the learnings from the government's previous efforts at 
issuing identity. 
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The UIDAI will be created as a statutory body under a separate legislation to fulfill its objectives. 
The law will also stipulate rules, regulations, processes and protocols to be followed by different 
agencies partnering with the UIDAI in issuing and verifying unique identity numbers. 

Features of the UIDAI model 

The Unique Identification number (UID) will only provide identity: The UIDAI's purview will 
be limited to the issue of unique identification numbers linked to a person's demographic and 
biometric information. The UID will only guarantee identity, not rights, benefits or entitlements. 

The UID will prove identity, not citizenship: All residents in the country can be issued a unique 
ID. The UID is proof of identity and does not confer citizenship. 

A pro-poor approach: The UIDAI envisions full enrolment of residents, with a focus on enrolling 
India's poor and underprivileged communities. The Registrars that the UIDAI plans to partner 
with - the NREGA, RSBY, and PDS - will help bring large numbers of the poor and underprivileged 
into the UID system. The UID method of authentication will also improve service delivery for the 
poor. 

Enrolment of residents with proper verification: Existing identity databases in India are 
fraught with problems of fraud and duplicate/ghost beneficiaries. To prevent this from seeping 
into the UIDAI database, the UIDAI plans to enrol residents into its database with proper 
verification of their demographic and biometric information. This will ensure that the data 
collected is clean from the start of the program. 

However, much of the poor and underserved population lack identity documents and the UID may 
be the first form of identification they have access to. The UIDAI will ensure that the Know Your 
Resident (KYR) standards don't become a barrier for enrolling the poor, and will devise suitable 
procedures to ensure their inclusion without compromising the integrity of the data. 

A partnership model: The UIDAI approach leverages the existing infrastructure of government 
and private agencies across India. The UIDAI will be the regulatory authority managing a Central 
Identities Data Repository (CIDR), which will issue UIDs, update resident information, and 
authenticate the identity of residents as required. 

In addition, the UIDAI will partner with agencies such as central and state departments and private 
sector agencies who will be 'Registrars' for the UIDAI. Registrars will process UID applications, 
and connect to the CIDR to de-duplicate resident information and receive UID numbers. These 
Registrars can either be enrollers, or will appoint agencies as enrollers, who will interface with 
people seeking UID numbers. The Authority will also partner with service providers for 
authentication. 

The UIDAI will emphasize a flexible model for Registrars: The Registrars will retain significant 
flexibility in their processes, including issuing cards, pricing, expanding KYR (Know Your 
Resident) verification, collecting demographic data on residents for their specific requirements, 
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and in authentication. The UIDAI will provide standards to enable Registrars maintain uniformity 
in collecting certain demographic and biometric information, and in basic KYR. These standards 
have been finalized by the Demographic Data Standards and Verification Procedures Committee 
and Biometric Standards Committees which was constituted by the UIDAI constituted. 

Enrolment will not be mandated: The UIDAI approach will be a demand-driven one, where the 
benefits and services that are linked to the UID will ensure demand for the number. This will not 
however, preclude governments or Registrars from mandating enrolment. 

The UIDAI will issue a number, not a card: The UIDAI's role is limited to issuing the number. This 
number may be printed on the document/card that is issued by the Registrar. 

The number will not contain intelligence: Loading intelligence into identity numbers makes 
them susceptible to fraud and theft. The UID will be a random number. 

The UIDAI will only collect basic information on the resident: The UIDAI will seek the 
following demographic and biometric information in order to issue a UID number: 

■ Name 

■ Date of birth 

■ Gender 

■ Father's/ Husband's/ Guardian's name and UID number (optional for adult residents] 

■ Mother's/ Wife's/ Guardian's name and UID number (optional for adult residents] 

■ Introducer's name and UID number (in case of lack of documents] 

■ Address 

■ All ten fingerprints, photograph and both iris scans 

Process to ensure no duplicates: Registrars will send the applicant's data to the CIDR for de- 
duplication. The CIDR will perform a search on key demographic fields and on the biometrics for 
each new enrolment, to ensure that no duplicates exist. 

The incentives in the UID system are aligned towards a self-cleaning mechanism. The existing 
patchwork of multiple databases in India gives individuals the incentive to provide different 
personal information to different agencies. Since de-duplication in the UID system ensures that 
residents have only one chance to be in the database, individuals will provide accurate data. This 
incentive will become especially powerful as benefits and entitlements are linked to the UID. 

Online authentication: The UIDAI will offer a strong form of online authentication, where 
agencies can compare demographic and biometric information of the resident with the record 
stored in the central database. The Authority will support Registrars and agencies in adopting the 
UID authentication process, and will help define the infrastructure and processes they need. 
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The UIDAI will not share resident data: The UIDAI envisions a balance between 'privacy and 
purpose' when it comes to the information it collects on residents. The agencies may store the 
information of residents they enrol if they are authorized to do so, but they will not have access to 
the information in the UID database. The UIDAI will answer requests to authenticate identity only 
through a 'Yes' or 'No' response 

Technology will undergird the UIDAI system: Technology systems will have a major role across 
the UIDAI infrastructure. The UID database will be stored on a central server. Enrolment of the 
resident will be computerized, and information exchange between Registrars and the CIDR will be 
over a network. Authentication of the resident will be online. The Authority will also put systems 
in place for the security and safety of information. 

Benefits 

For residents: The UID will become the single source of identity verification. Once residents 
enrol, they can use the number multiple times - they would be spared the hassle of repeatedly 
providing supporting identity documents each time they wish to access services such as obtaining 
a bank account, passport, driving license, and so on. 

By providing a clear proof of identity, the UID will also facilitate entry for poor and underprivileged 
residents into the formal banking system, and the opportunity to avail services provided by the 
government and the private sector. The UID will also give migrants mobility of identity. 

For Registrars and enrollers: The UIDAI will only enrol residents after de-duplicating their 
records. This will help Registrars clean out duplicates from their databases, enabling significant 
efficiencies and cost savings. For Registrars focused on cost, the UIDAI's verification processes will 
ensure lower KYR costs. For Registrars focused on social goals, a reliable identification number 
will enable them to broaden their reach into groups that till now, have been difficult to 
authenticate. The strong authentication that the UID number offers will improve services, leading 
to better resident satisfaction. 

For Governments: Eliminating duplication under various schemes is expected to save substantial 
money for the government exchequer. It will also provide governments with accurate data on 
residents, enable direct benefit programs, and allow government departments to coordinate 
investments and share information. 

Revenue Model 

By providing identity authentication, the UIDAI will be taking on a process that costs agencies and 
service providers hundreds of crores every year. The Authority will evolve suitable policies on the 
issue of charging a fee for its authentication services, which will offset its long-term costs. 
Registrars and service providers will also be able to charge for the cards they issue residents with 
the UID number. Such pricing will be within UIDAI guidelines. 
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Timelines 

The UIDAI will start issuing UIDs between August 2010 and February 2011, and plans to cover 600 
million people within 4 years from the start of the issuing of the first set of UIDs. This can be 
accelerated if more Registrars partner with the UIDAI for both enrolment and authentication. The 
adoption of UIDs is expected to gain momentum with time, as the number establishes itself as the 
most accepted identity proof in the country. 

Conclusion 

India will be the first country to implement a biometric-based unique ID system for its residents on 
such a large scale. The UID will serve as a universal proof of identity, allowing residents to prove 
their identity anywhere in the country. It will give the government a clear view of India's 
population, enabling it to target and deliver services effectively, achieve greater returns on social 
investments, and monitor money and resource flows across the country. 

The timing of this initiative is encouraging - the creation of the UIDAI coincides with growing 
social investment in India, a shift in focus to direct benefits, and with the spread of IT and mobile 
phones, which has made the public receptive to technology-based solutions. The UIDAI is 
committed to making this project a success. An initiative of this magnitude will also require the 
active participation of central, state and local governments, as well as public and private sector 
agencies across the country. With their support, the project will help realize a larger vision of 
inclusion and development for India. 
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A crucial factor that determines an individual's well-being in a country is whether their identity is 
recognized in the eyes of the government. Weak identity limits the power of the country's 
residents when it comes to claiming basic political and economic rights. The lack of identity is 
especially detrimental for the poor and the underprivileged, the people who live in India's "social, 
political and economic periphery". Agencies in both the public and private sector in India usually 
require a clear proof of identity to provide services. Since the poor often lack such documentation, 
they face enormous barriers in accessing benefits and subsidies. 

For governments and individuals alike, strong identity for residents has real economic value. 
While weak identity systems cause the individual to miss out on benefits and services, it also 
makes it difficult for the government to account for money and resource flows across a country. In 
addition, it complicates government efforts to account for residents during emergencies and 
security threats. 

However in India, the goal of issuing a universally used, unique identity number to each resident 
poses a significant challenge. A project of this scale has not been attempted anywhere in the world, 
and requires an innovative model, distinct from what we have witnessed in identity systems so far 
anywhere in the world. 

1.1 Historical background and evolution of the UIDAI project 

The Unique identification project was initially conceived by the Planning Commission as an 
initiative that would provide a clear and unique identity number for each resident across the 
country and would be used primarily as the basis for efficient delivery of welfare services. It would 
also act as a tool for effective monitoring of various programs and schemes of the Government. 

The concept of unique identification was first discussed and worked upon since 2006 when 
administrative approval for the project -"Unique ID for BPL families" was given on March 3rd, 
2006 by the Department of Information Technology, Ministry of Communications and Information 
Technology. This project was to be implemented by the NIC over a period of 12 months. 
Subsequently, a Processes Committee to suggest processes for updation, modification, addition 
and deletion of data fields from the core data base to be created under the Unique ID for BPL 
families Project was setup on July 3rd, 2006. 

A "Strategic Vision on the UID Project" was prepared and submitted to this Committee. It 
envisaged the close linkage that the UID would have to the electoral database. The Committee also 
appreciated the need of a UID Authority to be created by an executive order under the aegis of the 
Planning Commission to ensure a pan-departmental and neutral identity for the Authority and at 
the same time enable a focused approach to attaining the goals set for the XI Plan. The Seventh 
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Meeting of the Process Committee on 30th August 2007 decided to furnish to the Planning 
Commission a detailed proposal based on the resource model for seeking its "in principle" 
approval. 

At the same time, the Registrar General of India was engaged in the creation of the National 
Population Registrar and issuance of Multi-purpose National Identity Cards to citizens of India. 

Therefore, it was decided, with the approval of the Prime Minister, to constitute an Empowered 
Group of Ministers [EGoM] to collate the two schemes - the National Population Register under 
the Citizenship Act, 1955 and the Unique Identification Number project of the Department of 
Information Technology. The EGoM was also empowered to look into the methodology and 
specific milestones for early and effective completion of the Project and take a final view on these. 
The EGoM was constituted on December 4th, 2006. 

The first meeting of the EGoM was held on November 27th, 2007. It recognised the need for 
creating an identity related resident database, regardless of whether the database is created based 
on a de-novo collection of individual data or is based on already existing data such as the voter list. 
It also recognised that there is a crucial and imperative need to identify and establish an 
institutional mechanism that will "own” the database and will be responsible for its maintenance 
and updating on an ongoing basis, post its creation. 

The second meeting of the EGoM was held on January 28th, 2008. It decided on the strategy for 
the collation of NPRand UID. Inter-alia, the proposal to establish UID Authority under the Planning 
Commission was approved. 

The third meeting of the EGoM was held on August 7th, 2008. The Planning Commission had 
placed before the EGoM a detailed proposal for setting up the UIDAI. The meeting decided that 
certain issues raised by the members with relation to the UIDAI would need to be examined by an 
official level committee. It referred the matter to a Committee of Secretaries to examine and give its 
recommendations to the EGoM to facilitate a final decision. 

Subsequent to the Committee of Secretaries recommendations, the fourth meeting of the EGoM 
was held on November 4th, 2008.The recommendations of the Committee of Secretaries was 
presented to the EGoM and the following decisions were taken: 

a] Initially the UIDAI may be notified as an executive authority, and investing it with 
statutory authority could be taken up for consideration later at an appropriate time. 

b] UIDAI may limit its activities to the creation of the initial database from the electoral 
roll/EPIC data. UIDAI may however additionally issue instructions to agencies that 
undertake creation of databases to ensure standardization of data elements. 

c] UIDAI will take its own decision as to how to build the database. 

d] UIDAI would be anchored in the Planning Commission for five years after which a view 
would be taken as to where the UIDAI would be located within Government. 
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e) Constitution of the UIDAI with a core team of 10 personnel at the central level and 
directed the Planning Commission to separately place a detailed proposal with the 
complete structure, rest of staff and organizational structure of UIDAI before the 
Cabinet Secretary for his consideration prior to seeking approval under normal 
procedure through the DoE/CCEA. 

f] Approval to the constitution of the State UID Authorities simultaneously with the 
Central UIDAI with a core team of 3 personnel. 

g) December 2009 was given as the target date for UID to be made available for usage by 
an initial set of authorized users. 

h] Prior to seeking approval for the complete organizational structure and full 
component of staff through DoE and CCEA as per existing procedure, the Cabinet 
Secretary should convene a meeting to finalize the detailed organizational structure, 
staff and other requirements. 

1.1. Subsequently, on January 22nd, 2009 the Cabinet Secretary in pursuance of the decisions of 
the Empowered Group of Ministers considered the proposal submitted by the Department of 
Information Technology regarding the governance structure and recommended that 

a) The notification for constitution of the UIDAI should be issued immediately. 

b) A High Level Advisory, Monitoring and Review Committee headed by Deputy Chairman, 
Planning Commission to be constituted to oversee the work of the authority. 

c) A Member, Planning Commission or the Secretary, Planning Commission may be also 
assigned the task of looking after the work proposed of the Chief UID Commissioner. 

d) Core Team to be put in place. 

In pursuance of the Empowered group of Ministers' fourth meeting dated November 4th, 2008, the 
Unique Identification Authority of India was constituted and notified by the Planning 
Commission on January 28th, 2009 as an attached office under the aegis of Planning Commission 
with an initial core team of 115 officials. The role and responsibilities of the UIDAI was laid down in 
this notification. The UIDAI was given the responsibility to lay down plan and policies to 
implement UID scheme, and shall own and operate the UID database and be responsible for its 
updation and maintenance on an ongoing basis. 

Subsequently on July 2nd, 2009 Shri Nandan Nilekani was appointed as the Chairman of the UIDAI. 
Shri Nilekani assumed charge on 23rd July, 2009 and since then the UIDAI has started functioning. 

The Prime Minister's Council on UID Authority was constituted on 30th July, 2009 and its first 
meeting had taken place on 12th August, 2009. The Council endorsed the broad approach 
submitted by the UIDAI. 

Subsequently, the Government constituted a Cabinet Committee on Unique Identification 
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Authority of India vide its order no 1/11/6/2009 dated 22nd October, 2009. The functions of this 
Committee, as per this notification are: All issues relating to the Unique identification Authority of 
India including its organisation, plans, policies, programmes, schemes, funding and methodology 
to be adopted for achieving the objectives of that Authority. 

1.2 The UIDAI approach 

In 2007, the Planning Commission had recommended an approach to issuing unique identification 
numbers, where the enrolment into a Unique Identification [UID] database could be speeded up 
by using existing resident records in the databases of the Election Commission, PAN etc. This 
approach would speed up enrolment for those residents present in one of the aforementioned 
databases. These databases however, may contain inaccuracies. 

The model envisioned by the Unique Identification Authority of India [UIDAI] takes into account 
the inputs of the Planning Commission, as well as learnings from the previous approaches to 
identity. The detailed approach and the model of implementation is explained in subsequent 
chapters. 
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The UIDAI implementation model 

The model that the UIDAI envisions will have the reach and flexibility to enrol residents across the 
country. 

The UIDAI, as a statutory body, will be responsible for creating, administering and enforcing policy 
The UIDAI will prescribe guidelines on the biometric technology, the various processes around 
enrolment, and verification procedures to be followed to enroll into the UID system. The UIDAI will 
also design and create the institutional microstructure to effectively implement the policy. This 
will include a Central ID Data Repository (CIDR), which will manage the central system, and a 
network of Registrars who will establish resident touch points through Enrolling Agencies. 

2.1 The Central Identities Data Repository (CIDR) 

The CIDR will be the central data repository, and will function as a Managed Service Provider. It 
will implement the core services around the UID - it will store resident records, issue unique 
identification numbers, and verily, authenticate and amend resident data. 

The CIDR will only hold the minimum information required to identify the resident and ensure no 
duplicates. This will include: 

2.2 The Unique Identity Number 

The Unique ID or UID will be a numeric that is unique across all 1.2 billion residents in India. 

The UID number will not contain intelligence. In older identity systems, it was customary to load 
the ID number with information related to the date of birth, as well as the location of the person. 
However this makes the number susceptible to fraud and theft, and migration of the resident 
quickly makes location details out of date. The UID will be a random number. 

The UIDAI will also be collecting the following data fields and biometrics for issuing a UID: 

■ Name 

■ Date ofbirth 

■ Gender 

■ Father's/ Husband's/ Guardian's name and UID (optional for adult residents) 

■ Mother's/ Wife's/ Guardian's name and UID (optional for adult residents) 

■ Introducer's name and UID (in case of lack of documents) 

■ Address 

■ All ten finger prints, photograph and both iris scans 
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2.3 The Unique ID agencies 

The UIDAI will partner with a variety of agencies and service providers to enrol residents for UID 
numbers and verify their identity. 




Panchayat 


States 


Education 




The structure of these UID agencies will be as follows: 

Registrars - Registrars will be State governments or central government agencies such as the Oil 
Ministry and LIC. Registrars may also be private sector participants such as banks and insurance 
firms. 

The UIDAI will enter into memorandum of understandings' (MoUs) with individual Registrars, 
and enable their on-boarding into the UID system. The Registrars will need to make changes to 
their processes to be UID-ready. The UIDAI will support them in this, and in linking to the CIDR, 
connecting to the UID system, and adding UID fields to their databases. 

The Registrar will take on the responsibility of ensuring that clean and correct data flows into the 
CIDR. Their key role in the system will be in aggregating enrolments from sub-registrars and 
enrolling agencies and forwarding it to the CIDR. Each Registrar will adopt UIDAI standards in the 
technology used for biometrics, as well as in collecting and verifying resident information, and 
submitting to audits. 
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The UIDAI will also enter into agreements with some Registrars for using the CIDR solely for 
authentication purposes. The service providers who will adopt the UID system for identity 
authentication during service delivery will follow certain processes and standards, and may need 
to re-engineer their internal processes. 

Sub-Registrars - These will be the departments/entities that report to a specific Registrar. For 
instance, the line departments of the state government such as the RDPR (Rural Development and 
Panchayati Raj) department would be sub-registrars to the state government Registrar. 

Enrolling Agencies - Enrolling agencies will directly interact with and enrol residents into the 
CIDR. For example, the hospital where a baby is born would be the 'enrolling agency' for the baby's 
UID, and would report to the municipality sub-registrar. 

Outreach Groups - The UIDAI along with the Registrars will also partner with civil society groups 
and community networks which will promote the UID number and provide information on 
enrolment for hard to reach and marginalised populations. 

2.4 Setting standards on demographic data and biometrics 

The UIDAI's approach relies on the uniformity of standards in certain vital areas of operation. The 
Demographic data fields and verification procedure in the UID system as well as the Biometric 
standards to be utilized need to be standardized across the country and across the various 
registrars in the UID system. This is a sine qua non for the operability of the system. Hence, the 
UIDAI established two Committees to look into the issue of standards. 

Committee on Demographic Data Standards and Verification Procedures 

The UIDAI had constituted a Committee headed by Mr. N. Vittal, former CVC on 9th October 2009 to 
go into the question as to what demographic details should be collected from the residents for 
assigning of unique IDs. The Committee was also to go into the question as to what should be the 
process of verification of the residents at the time of their enrolment into the UID system. The 
mandate of the Committee was crucial because it is necessary to ensure that the integrity and 
correctness of the data is not compromised while ensuring that the process of verification is non¬ 
harassing to individuals. The Committee was mandated to give its report within 90 days of its 
constitution. However, it submitted its report on 9th December 2009, well before the ninety days' 
period given to it. The Report of the Committee has been accepted by the Authority. The Committee 
recommended the following data fields : Name, Date of birth, Gender, Father's/ Husband's/ 
Guardian's name and UID (optional for adult residents), Mother's/ Wife's/ Guardian's name and 
UID (optional for adult residents), Introducer's name and UID (in case of lack of documents) and 
Address. It has also specified the verification process which broadly falls into three categories (i) 
Document-based, (ii) Introducer-based (in case of lack of documents) and (iii) Community-based 
verifications, a process which will be followed during the creation of NPR. The Report of the Vittal 
Committee is available at www.uidai.gov.in 
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Committee on Biometric Standards 

As biometric attributes of the residents are going to be used as the basic signature for de- 
duplication and to ensure uniqueness, it is necessary to go into the question as to what should be 
the type and specifications of biometrics to be collected at the time of enrolment. Therefore, a 
Biometrics Standards Committee, under the Chairmanship of the Director General of NIC, Dr. BK 
Gairola was constituted by the Authority on 29th September, 2009. This Committee was also 
expected to give its report within 90 days of its constitution. The Report was submitted on 7th 
January, 2010. The UIDAI has examined their Report and has accepted the standards for various 
biometric attributes as recommended by the committee as also various other recommendations 
related to collection of biometrics and their quality. The UIDAI has also decided that the face, all 
ten finger prints and both iris scans should be collected at the time of capturing the demographic 
and biometric details of a resident. This will be able to ensure uniqueness of the IDs at a scale of 1.2 
billion residents. The report of the biometric committee is also available at www.uidai.gov.in 

The UIDAI was declared as an Apex body to set standards in the areas of biometric and 
demographic data standards by the Prime Minister's Council of UIDAI. Now that both these 
standards have been finalized by the UIDAI, these standards/specifications, processes and 
systems will be used by all the registrars to for enrolment of the residents into the UID system. 
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Enrolment into the UID system 

A critical aspect of the UID enrolment process is that enrolment will not be through a mandate, but 
will be demand driven. The momentum for the UID will come from residents enrolling in order to 
access the benefits and services associated with it. 

The basic advantage of the UID that can drive this demand, which will be communicated while 
promoting enrolment, is that the UID will be one number, which can be used to prove identity for 
life. Once the resident gets the unique ID, it may be accepted as identity proof across service 
providers. 

3.1 The enrolment process 

The enrolment process for the UID number will begin with a resident submitting his/her 
information to the enrolling agency with supporting documents. This information will be verified 
according to the prescribed verification procedure as per the DDSVP Committee Report. To make 
sure the poor are not excluded, the UIDAI has prescribed guidelines for applicants without 
documents. 

Once the enroller verifies the resident's information, it will submit the application request - either 
singly or in batches - through the Registrar to the CIDR. The CIDR will then run a de-duplication 
check, comparing the resident's biometric and demographic information to the records in the 
database to ensure that the resident is not already enrolled. 

Since de-duplication also compares biometric records, it would catch individuals enrolling with a 
different set of demographic details. The fact that the UID system is both de-duplicated and 
universal will discourage residents from giving incorrect data at the time of enrolment. 
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(Ration Shop. Cyber Kiosk, Bank etc) Card 


Issuing the UID number 

Once the UID number is assigned, the UIDAI will forward the resident a letter which contains 
his/her registered demographic and biometric details. This letter may also have a tearaway 
portion which has the UID number, name, photograph and a 2D barcode of the finger print 
minutiae digest. If there are any mistakes in the demographic details, the resident can contact the 
relevant Registrar/enrolling agency as per a prescribed procedure. 

If the Registrar issues a card to the resident, the UIDAI will recommend that the card contain the 
UID number, name and photograph. They will be free to add any more information related to their 
services (such as Customer ID by bank). They will also be free to print/ store the biometric 
collected from the applicant on the issued card. If more registrars store such biometric 
information in a single card format, the cards will become interoperable for offline verification. 
But the UIDAI will not insist on, audit or enforce this. 

All data entry that the enrolling agencies take upon behalf of the Registrars will be done in English. 
It can then be converted into the local language using standard transliteration software, and 
verified for accuracy by the Registrar. The letter the UIDAI sends the resident will consequently 
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contain all demographic details in English as well as the local language of the state in which the 
resident resides. In this regard, the UIDAI will follow the precedent set by the Election Commission 
oflndia. 

3.2 Enrolment strategy in rural and urban India 

The approach of the UIDAI to enrolment will be a pro-rural/pro-poor one. The Registrars targeted 
for rural India - the NREGA, PDS, Social security pensions - will be government agencies with large 
rural networks and significant bases among the poor. As a result, the UIDAI expects initial 
enrolment to be fairly rapid in both large and small rural areas. 


All India Annual enrollment (In millions) 



Yr 1 Yr 2 Yr 3 Yr 4 Yr 5 Yr 6 Yr 7 Yr 8 Yr 9 Yr 10 


— Large urban (>50,000) 
Small urban (<50,000) 
Large rural (>2000) 
Small rural (<2000) 


The enrolment strategy for urban India will include organizations which dominate services for 
urban residents, such as LIC and Passports. The table below summarizes the Registrars who are 
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UID Registrar 

Primary 

Access 1 

Additional 

Acces 2 3 

Potential 

Overlap 

Effective 

Enrolment 

Crore Residents 

LPG (Oil PSU] 

CO 

CO 

16.8 4 

20% 

20.2 

LIC (Life Insurance] 

13.5 

13.5 

50% 

13.5 

PAN Cards 

4.0 

- 

75% 

1.0 

Passports 

6.0 

- 

80% 

1.2 

Urban Enrolment 




35.9 






Lie (Life Insurance] 

3.5 

3.5 

90% 

0.7 

NREGA 

10.0 

20.0 

10% 

27.0 

BPL Ration Cards 

7.0 

21.0 

60% 

11.2 

State BPL/APL 

15.0 

45.0 

50% 

30.0 

Old Age Pensioners 

1.5 

1.0 

70% 

0.8 

Women/Child Welfare 

1.0 

2.0 

70% 

0.9 

Social Welfare 

1.0 

2.0 

70% 

0.9 

RSBY 

0.5 

1.0 

70% 

0.5 

Rural Enrolment 




72.0 

Total Enrolment 




107.9 


In addition to these enrollers, the UIDAI will also partner with the Registrar General of India (RGI] 
- who will prepare the National Population Register through the Census 2011 - to reach as many 
residents as possible and enrol them into the UID database. This may require incorporating some 
additional procedures into the RGI data collection mechanism, in order to make it UID-ready. 

3.3 A focused effort to enrol the poor and hard to reach groups 

While the UIDAI intends to target Registrars that have large networks among the poor and rural 
communities in India, it will also emphasize multiple approaches to reach specific, frequently 
marginalized groups. 


'These are residents who are part of the Registrar's customer / subsidiary beneficiary database and can be mandated to 
provide their UID 

2 The residents under additional access are family members who can be easily covered while enrolling the primary residents. 
These can be all family members in the case of LPG connections and the nominees in case of LIC Policies. 

3 The total number of gas connections is 10.51 crores, and this estimates that there are 20% ineligible connections 

'Assuming there are an average of three members in each family having a gas connection from an Oil PSU 
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Urban Poor 

The urban poor are among the most ignored and disadvantaged people in India. The main 
challenges in enrolment here exist because this group consists mainly of migrant workers with 
temporary or seasonal jobs. The following maybe ways to get them enrolled into the UID system. 

Co-resident enrolment: Many of India's urban poor work as drivers, maids, or as workers 
associated with a family or a business. One approach to reach them could be for the head of the 
family or business to enable these members (who are co-residents/co-workers] to get enrolled 
into the UID with the same address proof the business or family uses. There can be a host of 
financial incentives offered to enrol such co-residents. 

Financial institutions: The urban poor often borrow from micro-finance institutions and other 
sources and these could serve as enrolment points for them. There are established chit funds that 
can also act as enrolment points for the UID to improve coverage. 

NGOs and Non-profits: There are several established non-profits working in urban slums in 
education, healthcare and social empowerment. They can be used to educate the poor on the 
benefits of the UID, for actual enrolment and to help endorse identity for people who lack 
documentation. 

Children 

India is a young country with over 400 million residents below the age of 18. While family-based 
government schemes will as Registrars, help enrol children, this population may need to be 
specifically targeted. 

ICDS: ICDS is one of the world's largest integrated early childhood programs, with over 40,000 
centers nationwide. The program covers over 5 million expectant and nursing mothers and 25 
million children under the age of six. These centers can be information or enrolment points for 
non-school going children. 

School admission: It may be mandated that at the time of joining school (first standard] it is 
necessary for children to have a UID or to enrol for one. This way the child can be tracked for 
progress and targeted for direct benefits. 

The SSA program could also help enrol children in the 6-14 age group into the UID, which would 
also enable better child tracking and improvements in the mid-day meal schemes. 

For children, the advantages from the UID would be significant. Child-related programs in India 
have relied on often inaccurate, aggregate data at school/cluster/block levels, making these 
programs ineffective. The concept of Universal Child Tracking - the ability to track every child and 
ensure their all round development - is gaining ground. An accurate database of children with 
UIDs would be immensely beneficial to programs within the Women and Child welfare as well as 
the Education departments, which track development in anganwadis and progress of children in 
government schools, and work to eliminate child labor. 
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Women 


Apart from enrollers that are family-based government services in both urban and rural India such 
as PDS, RSBY etc, there needs to be a strategy to cover women outside this net: 

Financial institutions: Robust collectives of women exist within micro-finance institutions and 
self-help groups across the country. These would be important enrolment points for women. 

Organizations like Mahila Samakhya in the 9 states of Karnataka, Kerala, Andhra Pradesh, Gujarat, 
Uttar Pradesh, Uttar Khand, Assam and Jharkhand. They work in several thousand villages to help 
women and can act as touch points for education or enrolment of women. 

The National Commission for Women: This is the apex national level organization of India for 
protecting and promoting the interests of women. They have a massive outreach program that can 
reach out to disadvantaged women and get them to enrol. The UID can subsequently be used as a 
unique handle for a variety of services to be rendered to these women. 

Differently-abled people 

It is estimated that India has over 60 million differently-abled people, and identity for this 
population is a massive challenge. The Disability Act of 1995 mandates a certain percentage of 
employment for the differently-abled, but without the clear identification of such individuals, it is 
difficult to enforce the law. There is an obvious incentive for organizations like National Center for 
Promotion of Employment for Disabled People (NCPEDPJ to promote the UID, and enable 
residents with disability to register for a range of benefits. The NGOs and rights groups associated 
with NCPEDP would also be good mechanisms to reach out to this section of the population. 

Tribals 


India has a significant tribal population of approximately 90 million tribals, mostly concentrated 
along a few states. The Government has many programs for the 697 notified tribes, which can be 
used for enrolment and information dissemination. In addition, NGOs and governments in states 
with high tribal populations can be Registrars for tribal groups. 

The above mentioned approaches are merely indicative of the strategy that the UIDAI will follow to 
reach marginalized groups. In addition, the UIDAI will reach out to other marginalized groups such 
as homeless people, individuals in shelter homes, remand homes, asylums, etc. 

Civil Society Outreach strategy 

3.4 Enrolment costs 

Enrolment costs can be thought of in two ways. One will be the cost to the enrolling 
agencies/Registrars for carrying out the enrolment process. The other costs will be to the 
residents to come to the enrolment stations. Poor may have to forego their wages for a day and also 
spend some travel costs to travel to the enrolment stations The enrolment strategy will explore the 
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possibility of various mechanisms for funding the enrolment costs. The Registrars have the option 
here of charging for the cards they issue residents to offset enrolment costs. The UIDAI may issue 
guidelines around such pricing. 

3.5 Ensuring clean enrolment data from Registrars 

The UIDAI will periodically carry out a process audit of the information that comes in from the 
Registrars, to ensure data quality and that agencies are following guidelines recommended by the 
UIDAI. The audit would be on a random sample of residents, carried out either directly by the 
Authority or through appointed agencies. The audit might focus on: 

Verification against scanned documents - The data contained in the resident records will be 
verified against the scanned documents. 

Physical document verification - The physical documents that are held by the Registrar will be 
validated against the electronic copies. 

Periodic process audits- Periodic audits will be carried out to at the enrolment sites, of the 
processes and software. 

3.6 Updating UID details 
Updating information with the UIDAI 

The UID number is a lifetime number, but the biometric information contained in the central 
database will have to be regularly updated. Children may have to update their biometric 
information every five years, while adults update their information every ten years. 

From time to time, the demographic information that the CIDR holds on the resident may also 
become outdated. Fields that are susceptible to change could be the 'present address' field, as well 
as the resident's name (after marriage). There might also be an error in the fields that occurred 
during enrolment into the UID. 

If a service provider authenticating or enrolling a resident finds, through its KYR process that the 
information provided by the resident (address, name, etc.) does not match with the UID record, or 
that the biometrics need to be renewed, it can ask the resident to update their information in the 
UID database. The service provider may make the update a condition for the resident to receive the 
service/benefit. 

Enrolling agencies and Registrars can serve as points where the resident can update their UID 
fields. The resident will have to submit their new information at these updation points with the 
required documentary evidence. This may also include a biometric authentication prior to 
processing the request. 
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3.7 Reaching critical mass in enrolments 

The Authority expects to start issuing the first set of UIDs between August 2 010 to February 2011, 
and enrolment for the UID number is expected to reach a critical mass of around 200 million 
residents in two to three years. Until this point, the UIDAI will have to focus on generating demand 
from both Registrars and residents. However, once the critical mass is achieved, it will generate a 
network effect that drives demand and accelerates adoption among service providers and 
residents. And as more service providers across the country require the UID to dispense their 
services and benefits, adoption will ramp up rapidly. In four years, the UIDAI estimates that it will 
issue 600 million UID numbers. 
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3.8 Tracking enrolments across the country 

The UIDAI will employ a GIS internet-based visual reporting system to track enrolment trends and 
patterns across India, as the project is rolled out across various Registrars and states. 




^ tap*#** 

iV * * te +w **-* * .*? 

> 0 0 0 Va«« * f C«UmAM « 

-- • f ' k... ■ P-*V ^ 


iV-J • 


^ * Q ’ ' «P * !*9»* 9 r 8**» • 


National UID Project 


^ iMt o» 




UID Enrollments Statewise 

































Unique Identification Authority of India 

Strategy Overview 


23 


The GIS system will show all UID enrolments by state, as well as by Registrar. The system will also 
be able to drill down within states and into districts. 

3.9 Reaching a sustainable, steady-state in enrolment 

A challenge for full enrolment is registering the approximately 60,000 babies that are born in the 
country every day. Over the next several years, the UIDAI expects to enrol close to the entire Indian 
population. Once that goal is achieved, enrolment will reach a steady state, where only births (and 
deaths] as well as immigrants need to be recorded. 

There are however, some challenges in registering new births. First, since their biometrics is not 
stable, they have to be re-scanned at a later age. Second, names are often not given in India at the 
time of birth registration. 

The UID in the birth certificate 

One way to ensure that the UID number is used by all government and private agencies is by 
inserting it into the birth certificate of the infant. Since the birth certificate is the original identity 
document, it is likely that this number will then persist as the key identifier through the 
individual's various life events, such as joining school, immunizations, voting etc. 

Since the name is a mandatory field in the UID database, it is essential that the child be given a 
name before applying for the UID number. This would ensure that the UID can also be allotted at 
birth. 

In the case of urban births, the municipality will be the enrolling authority and 
the UID Registrar can be the 'Registrar of Births, Deaths and Marriage' at the 
state level. 

In rural areas, births take place at district or block level hospitals, in health 
care centers and at homes in the village. The village accountant is the Registrar 
of rural births, and he/she also issues the birth certificate and updates the 
information through an enrolling agency. 
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Biometrics and infants 

The recording of unique individual biometrics in the UID database is a challenging one for infant 
records. The solution to this is to record the UID and biometric of the parents in the child's record. 

The child's biometrics need to be taken at around 5 years of age, and updated in the UID system 
every 5 years until the age of 18. This will be enforced by an expiry date attached to the UID 
number, which will become invalid after that date. Until the time the biometric of the child 
stabilizes, any one of the parents/guardian will need to provide their biometric information for 
authentication. 

Recording deaths in the UID system 

It is also necessary to record deaths in the country, and the birth and death registration act 
provides for such registration. The same institutions that record births can be in charge of 
updating deaths in the UID system. The UID system will not remove a record upon the person's 
death; it will simply mark it as 'deceased' and hence will render it inactive for the purposes of 
authentication. 
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Ensuring strong authentication, and what it means for the UIDAI 

The real test of reliability for the UID system will be during identity authentication. Confirming 
'you are who you say you are' remains the primary, often elusive goal of all identity systems. 

The UIDAI approach - which will be online authentication, with biometric check - creates a very 
strong authentication system, and gives the UIDAI significant ability to confirm an individual's 
identity. The UIDAI will support the Registrars in building the infrastructure and systems 
necessary to authenticate residents in different parts of the country. This will be especially critical 
for Registrars working in rural areas and among the poor. 

4.1 Enabling UID adoption for authentication 

The speed of UID adoption in India depends on whether the number can help in eliminating 
poverty and marginalization, and in enabling greater transparency and efficiency in service 
delivery. If it succeeds in these goals, the number will become indispensible for residents in 
accessing services. 

While the UID can provide the strongest form of pre-verification and identity authentication in the 
country, it cannot ensure that targeted benefit programs reach intended beneficiaries. The pro¬ 
poor impact of the UID, consequently, will not gain traction unless there is a mechanism to link the 
UID process with actual service delivery. 

A clear adoption process can overcome this gap by helping introduce the UID method of 
authentication at every point of service delivery. To ensure this, the UIDAI will not only work with 
Registrars who do enrolment, but also with non-enrolling, service delivery agencies. Such 
agencies involved in the delivery of services and benefits will be encouraged to partner with the 
UIDAI for authentication. Once they authenticate a resident's identity against the UID database 
every time they carry out a service transaction, they will be able to deliver services far more 
effectively. 

In order to accommodate this authentication, agencies may need to re-engineer their business 
processes to be UID-enabled. The most basic requirement for change will be in incorporating the 
UID method of authentication into their systems. Agencies will have to adhere to norms and 
procedures specified by the UIDAI for fingerprint capture and verification, and introduce a robust 
biometric authentication process at every point of sale. 

There is tremendous value to be gained from widespread adoption of the UID for authentication, 
especially for residents. While enrolment in the UID database will ensure that residents are not 
denied access to fundamental services and rights because they cannot present positive proof of 
identity, adoption in authentication could go one step further, and ensure that residents 
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consistently receive these services. This can include a wide range of benefits such as education, 
health coverage, old-age pensions and subsidized food grains, thereby fulfilling the UIDAI's pro 
poor agenda. 

The UIDAI is only in the identity domain. The responsibility of tracking beneficiaries and the 
governance of service delivery will continue to remain with the respective agencies - the job of 
tracking distribution of food grains among BPL families for example, will remain with the state 
PDS department. The adoption of the UID will only ensure that the uniqueness and singularity of 
each resident is established and authenticated, thereby promoting equitable access to social 
services. 

The adoption of the UID during authentication will also have a direct correlation with subsequent 
enrolment. Greater enrolment comes from the value a resident derives from the UID, which in turn 
depends on the rate of adoption. There is a positive cycle here, created from the relationship 
between adoption and enrolment - the greater the adoption, the faster the enrolment and vice 
versa. The twin approaches of enrolment and adoption will result in greater influence and traction 
for the UID among residents in the country, and establish the UIDAI as the only genuine identity 
authenticator in India. 

4.2 Types of authentication 

There are multiple forms of authentication that the UID authority can offer. Certain types of 
authentication would have low to medium assurance if there is the possibility that the card is 
forged. Here we summarize the main forms of authentication, depending on the situation and 
equipment available. 

Online authentication is supported by the UID system. This can include 

Online demographic authentication where the authenticating agency compares the UID 
number and demographic information of the UID holder to the information stored in the UID 
database. The assurance level here is medium. 

Online biometric authentication where the biometrics of the UID holder, his UID and key 
demographic details are compared to the details in the CIDR. The assurance level in this case 
is high. 

Online demographic/biometric authentication with API where the Registrar's backend 
system makes a programmatic call to the authentication APIs exposed by the UID system to 
perform authentication. The assurance level here may be medium-high depending on 
whether the check used demographic or biometric inputs. 

Offline authentication may be supported by the Registrar, and does not use the authenticating 
service provided by the UIDAI. This may come in two forms: 

Photo match authentication where the photo on the card is compared with the cardholder. 
This is the most basic form of authentication. The assurance level here is low. 
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Offline biometric authentication compares the scanned fingerprint of the cardholder to the 
biometric stored on the Registrar-issued card. The assurance level here is medium. 



4.3 Authentication and the UIDAI revenue model 

The ability of the UIDAI to offer agencies across the country strong, reliable authentication is the 
key to its sustainability. The UIDAI will offer resident authentication services for a fee to 
governments and private sector firms. 

The agencies which request a resident authentication service will have to be registered with the 
UIDAI and follow strict guidelines in using the service as well as in managing resident information. 

Basic identity confirmation 

Basic identity confirmation from the UIDAI would be free. In this transaction, the authenticator 
will provide the UID number, name and one other parameter such as date of birth of the person, 
and the central database will confirm the identity as a 'Yes' or 'No' response. 

This type of transaction will be carried out in large numbers and will need quick response times. 

Chargeable authentication services can be of two types: 

Address verification 

For security purposes, government agencies as well as private sector firms require address proof 
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from Indian residents before providing them with benefits and services. However, agencies often 
complain of the difficulty of address verification "you try to verify an address in India, and you 
enter a labyrinth". The service provider usually verifies address through a physical visit, as well as 
an enquiry to confirm the other information provided. This process is expensive and costs 
between Rs. 100 and Rs. 500 perverification. 

The address authentication service the UIDAI will offer these entities would consequently be a 
valuable one. In the proposed transaction with the UID Authority, the agency will submit the UID, 
name and address of the resident to the CIDR, which will confirm the address. As a result, the 
agency will not have to do physical address verification. 

Biometrics confirmation 

Services such as issuing a credit card or granting a loan need the confirmation of the resident's 
identity. This process for the resident involves the submission of photographs and other 
documentation confirming their identity. In the proposed transaction with the UID Authority, the 
agency can send the scanned photograph or fingerprint (based on the security level required] 
together with other demographic details to confirm the identity of the person. 

Revenue projections from authentication services 

The following revenue model for the UIDAI is an illustrative one. It has been designed while 
keeping in mind the value the agency requesting authentication would derive from the service. 
The table below summarizes the kind of transaction, potential user agencies and the proposed 
transaction fee. Government agencies could be provided these services from the UIDAI at a 
subsidized rate. 


SI. 

Transaction Type 

Transaction Fee 

Potential User Agencies 

1 

Basic ID Confirmation 

Free 

Airlines during passenger check-in 

2 

Address Verification 

Rs. 5 

Banks for account opening 

3 

Biometrics Confirmation 

Rs. 10 

Credit cards issue process 


The authentication service from the UIDAI can begin after the initial bulk on-boarding of 
Registrars. The revenue estimates for the UIDAI below are based on the current expenditure of 
various agencies on KYR processes, which would be replaced by the Authority's authentication 
services. It also takes into account expected growth in demand for mobile connections, bank 
accounts, etc. 
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UID Revenue Projection 

(Steady State Estimates) 

Transaction Type 

Address 

Biometrics 

New Mobile Connections 

19.59 

- 

PAN Cards 

- 

1.20 

Gas Connections by PSU 

- 

1.50 

Passports 

0.06 

- 

LIC New Policies 

- 

10.16 

Credit Cards 

0.70 

- 

BankAccounts 

11.55 

- 

Airline Check-in 

- 

- 

Projected Total Transactions 

31.91 

12.86 

Proposed Transaction Rate 

5 

10 

Transaction Revenue 

159.55 

128.60 

Estimated total annual revenue 

at steady state (Rs. Crores) 

288.15 
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The Constitution of India, through the Directive Principles of State Policy 5 mandates that the state 
shall strive to minimize inequalities of income and endeavor to eliminate inequalities in status 
amongst individuals. The objective of the UIDAI is to solve the key problem of identity that 
individuals face and enable better and efficient delivery of services to the poor and marginalized 
so as to eliminate inequalities of income and status. It is therefore, imperative to have a proper 
legal structure in place to ensure the smooth functioning of the UIDAI. This section provides an 
overview of the legal and policy framework. 

The Unique Identification Authority of India (UIDAI) will be set up as a statutory body by an Act of 
Parliament. The UIDAI will be authorized: 

o To collect the following identity information from any person voluntarily seeking a unique 
identity number: 

■ Name 

■ Date of Birth 

■ Gender 

■ Father's name and UID number 

■ Mother's name and UID number 

■ Address 

■ All ten finger prints, photograph and both iris scans 

The law will contain a prescription against collecting any other information than the information 
permitted, with specific prohibitions against collection of information regarding religion, race, 
ethnicity, caste and other similar matters, and for the facilitation of analysis of the data for anyone 
or to engage in profiling or any similar activity. 

o To issue a unique identity number to the person who has provided the necessary information 

and fulfilled the requirements as laid down in rules prescribed by the UIDAI. 


Art. 38 5 (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a 
social order in which justice, social, economic and political, shall inform all the institutions ofthe national life. 

(2) The State shall, in particular, strive to minimise the inequalities in income, and endeavour to eliminate 
inequalities in status, facilities and opportunities, not only amongst individuals but also amongst groups of 
people residing in different areas or engaged in different vocations. 
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0 

To verily the identity of any person at the time of the provision of information, the issuance of 
a unique identity number or at any other time per the U1DAI database or other possible 
means, as laid down in rules prescribed by the UIDAI. 

0 

To permit the UIDAI to set up or facilitate the infrastructure by which third parties can 
authenticate the identity of persons who have provided information to the UIDAI and the 
circumstances and conditions they can seek such verification. The information on the 
database will be used only to authenticate identity. 

0 

To establish or appoint a Central ID Data Repository (CIDR) for the purposes of collecting, 
managing and securing the database and to outsource any such functions. 

0 

To permit the appointment of Registrars in accordance with criteria laid down by the UIDAI 
to enrol people that seek unique identity numbers directly or indirectly through enrolling 
agencies. 

0 

To allow for the appointment of other service providers in accordance with criteria laid 
down by the UIDAI, as the UIDAI may deem fit to further its objectives and to ensure 
efficiency. 

0 

To call for information and records, conduct inspections, inquiries and audit of the CIDR, 

Registrars, enrolling agencies and service providers.. 

0 

To enter into all necessary contracts and arrangements in order to fulfill the objectives of the 

UIDAI. 

0 

To set up mechanisms for grievance redressal for the public 


0 

To set up a monitoring framework to improve implementation, create safeguards as required 
and study the impact of the UID 

0 

To hire the necessary technical and professional personnel necessary for executing the 
mandate and fulfill the objectives ofthe UIDAI. 

The law will also contain 


0 

Penal provisions against persons employed by, or associated directly or indirectly with, the 

CIDR, Registrars, enrolling agencies and other service providers for failing to comply with 
the directions issued under the Act 

0 

Penal provisions against persons employed by, or associated directly or indirectly with the 

UIDAI, CIDR, Registrars, enrolling agencies and other service providers for breach of certain 
key sections of the legislation - including the specific prohibitions on profiling, the disclosure 
of information and maintenance of confidentiality etc. 

0 

Penal provision for persons who intentionally or fraudulently provide wrong information, 
attempt to obtain a second unique identity number, steal the identity of any living or dead 
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person, etc. In this context, there will be no liability on the part of the U1DAI or persons 
employed by, or associated directly or indirectly with the UIDAI, CIDR, Registrars, enrolling 
agencies and other service providers for providing a unique identity number to a person who 
intentionally or fraudulently obtains such number. 

Protecting privacy and confidentiality 

The information that the UIDAI is seeking is already available with several agencies (public and 
private) in the country, the additional information being sought by the UIDAI are the finger prints 
and iris scans. However, the UIDAI recognizes that the right of privacy must be protected, and that 
people are sensitive to the idea of giving out their personal information, particularly the idea of 
information being stored in a central database to be used for authentication. UIDAI will protect the 
right to privacy of the person seeking the unique identity number. The information on the 
database will be used only to authenticate identity. Necessary provisions would be in place to 
address the issues of privacy and confidentiality. 

Offences under the UIDAI Act 

The UID database will be susceptible to attacks and leaks at various levels. The UIDAI must have 
enough teeth to be able to address and deal with these issues effectively. It will bean offence under 
the UIDAI Act to engage in the following activities: 

• Unauthorized disclosure of information by anyone in the UIDAI, Registrar or the Enrolling 
agency 

• Disclosure ofinformation violatingthe protocols setin place by the UIDAI 

• Sharing any of the data on the database with anyone. 

• Engaging in or facilitating analysis of the data for anyone. 

• Engaging in or facilitating profiling of any nature for anyone or providing information for 
profiling of any nature for anyone. 

• All offences under the Information Technology Act shall be deemed to be offences under the 
UIDAI if directed against the UIDAI or its database. 
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Data Security and Fraud 

6.1 Protecting personal information of residents 

Even as the UIDAI stores resident information and confirms identity to authenticating agencies, it 
will have to ensure the security and privacy of such information. 

By linking an individual's personal, identifying information to a UID, the UIDAI will be creating a 
transaction identity for each resident that is both verified and reliable. This means that the 
resident's identity will possess value, and enable the transfer of money and resources. 

The UIDAI envisions storing basic personal information, as well as certain biometrics. However, 
limiting its scope to this, and not linking this information to financial/other details does not make 
the resident records in the database non-sensitive. Biometric information for example, is often 
linked to banking, social security and passport records. Basic personal information such as date of 
birth is used to verify owners of credit card/bank accounts and online accounts. Such information 
will therefore, have to be protected. Loss of this information risks the resident's financial and other 
assets, as well as reputation, when the resident is a victim of identity theft. 

In the federated system that the UIDAI envisions, we must consequently have processes in place to 
ensure a fair level of data security. 
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6.2 Fraud scenarios 

The Authority will concern itself only with identity fraud, which is distinct from document fraud. 
Document fraud the use of counterfeited/misleading documents to enter incorrect personal 
information will be the responsibility of the Registrar enrolling the resident. The Authority will 
have clear response mechanisms in place for identity fraud, where an individual deliberately 
impersonates someone else, either real or fictitious. 

Since the CIDR will store the biometric of residents, identity fraud will be easier to control. The 
only form of fraud that may go undetected in the UID system is if a person registers his/her details 
and biometrics under an entirely different name, with forged supporting documents. However, the 
person will have to exist under this name across systems, in the lifetime of his/her interaction with 
the government, private agencies and service providers. Such instances are therefore, likely to be 
rare. 


Some of the potential fraud scenarios are: 


Scenario 

Response 

Person applies for a UID number 
and presents wrong information 
under their name. 

The verification process returns application to 
the applicant and presents the reasons for not 
issuing number. 

Person applies to get a second 
card in another name. 

Application returned, with reason provided. 

If person's name was fraudulent the first time, 
he has the option of applying to change his 
demographic fields, if this fraud is attempted again, 
person is added to watch list/ legal action. 

Person appears as himself, 
and applies for a second 

UID number. 

Application returned, with reason provided. 

If attempted more than three times person 
added to watch list. 

Person appears as another 
existing person, registering 
the second person's information 
under his fingerprint. 

Impersonation of a deceased 
individual, with fake supporting 
documents. 

The victim can report identity theft to the UIDAI's 
grievance office. The UIDAI will undertake an 
investigation, and take appropriate action if theft 
is confirmed. 

If the applicant passes the verification process, 
then he may be able to take on the stolen identity. 
However, he will not be able to change his demographic 
fields over his lifetime without due process. 

De-duplication works incorrectly 
and returns false positive for 
a new UID applicant. 

Person can request check against face biometrics 
as well as re-verification by Registrar. 
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7 



The technical architecture of the UIDA1 is at this point, based on high-level assumptions. The 
architecture has been structured to ensure clear data verification, authentication and de- 
duplication, while ensuring a high level of privacy and information security. 


7.1 System architecture 


The Central ID Data Repository will be the central database of all residents, containing the minimal 
set of fields sufficient to confirm identity. The federated set of databases belonging to the 
Registrars may contain additional information about the resident, and can use the resident's UID 
as the key. 
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The key technology components of the UID system are: 

• The UID Server, which provides the enrolment and the authentication service. These 
services will be available over the network for the various Registrars and their 
authenticating agencies to use. The backend servers need to be architected for the high 
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demands of the 1:N biometric de-duplication as well as the large peak loads from 
authentication requests. 

• The Biometric sub-system is central to the U1D system for enrolling as well as 
authenticating residents. It is likely that a multi-modal biometric solution will be used to 
achieve a high level of assurance. The 1:N de-duplication envisioned will be by far the most 
computing-intensive operation of the UID system. Innovative techniques of hashing, 
indexing, distributed processing, and in-memory databases using multiple-biometric- 
modes need to be employed to get acceptable performance. 

• The Enrolment client application will capture and validate demographic and biometric 
data. This client needs to work in an offline mode in the village setting when there is no 
internet connectivity, and upload batch files to the server for processing. Alternatively the 
batch files can be physically transported to the CIDR for uploading The client application 
will be deployed on a standard enrolment workstation. 

• The Network is a critical aspect of the system, since all UID enrolment and authentication 
services will be available online. UID services could work over secure WAN networks, the 
vanilla internet or over mobile SMS channels. It could also potentially work over existing 
networks such as credit-card POS (point-of-service) devices. 

• The Security design secures all the above components from logical/physical attack. This 
includes. 

o Server Security-firewall, intrusion prevention and detection systems [IPS, IDS] 

o Network, Client Security- Encryption, PKI etc 

• The Administration system will help administer the UIDAI's operations. This includes 

o Account setup - creation/modification of Registrar, enrolling and authenticating 
agency accounts. 

o Role based access control - Assign rights over UID resources based on role, 

o Audit trailing - track every access to the UID system, 
o Fraud detection - detect identity theft and cyber crimes using audit trails 
o Reporting and Analytics - Visual decision support tools - GIS, Charting etc. 
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One of the unique challenges in executing the UID project is its scale. Due to the size of India's 
population, the UIDAI is undertaking what is perhaps the largest governance-related exercise in 
the world. We must ensure that all aspects of the project - enrolment, de-duplication, and 
authentication - function effectively even as the number of records approaches a billion. 

8.1 Addressing challenges of scale 

The UIDAI can expect its enrolment run-rate to have a peak load of one million enrolments per day 
in the very first year of operation. Every sub-system and component of the UID system will need to 
scale quickly and significantly. This will include: 

1} The ability to onboard Registrars from different sectors and handle their constituencies of 
residents. 

2 ) The legal framework of contracts needs to support the variety and spread of stakeholders as 

their numbers grow exponentially across the country. 

3} The biometric de-duplication algorithm needs to scale towards checking a fingerprint 
against every one of 1.2 billion people to ensure uniqueness. 

4] The authenticating service, which may be used by tens of thousands of points across the 
country, needs to scale to handle hundreds of thousands of transactions per second. 
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Project Risk 

The UID project does face certain risks in its implementation, which have to be addressed through 
its architecture and the design of its incentives. Some of these risks include: 

1 ) 

Adoption risks: There will have to be sufficient, early demand from residents for the UID 
number. Without critical mass among key demographic groups (the rural and the poor] the 
number will not be successful in the long term. To ensure this, the UIDA1 will have to model 
de-duplication and authentication to be both effective and viable for participating agencies 
and service providers. 

2) 

Political risks: The UID project will require support from state governments across India. 

The project will also require sufficient support from individual government departments, 
especially in linking public services to the UID, and from service providers joining as 

Registrars. 

3) 

Enrolment risks: The project will have to be carefully designed to address risks of low 
enrolment - such as creating sufficient touch points in rural areas, enabling and motivating 

Registrars, ensuring that documentary requirements don't derail enrolment in 
disadvantaged communities - as well as managing difficulties in address verification, name 
standards, lack of information on date of birth, and hard to record fingerprints. 

4) 

Risks of scale: The project will have to handle records that approach one billion in number. 

This creates significant risks in biometric de-duplication as well as in administration, 
storage, and continued expansion of infrastructure. 

5) 

Technology risks: Technology is a key part of the UID program, and this is the first time in 
the world that storage, authentication and de-duplication of biometrics are being attempted 
on this scale. The authority will have to address the risks carefully - by choosing the right 
technology in the architecture, biometrics, and data management tools; managing 
obsolescence and data quality; designing the transaction services model and innovating 
towards the best possible result. 

6) 

Privacy and security risks: The UIDAI will have to ensure that resident data is not shared or 
compromised. 

7) 

Sustainability risks: The economic model for the UIDAI will have to be designed to be 
sustainable in the long-term, and ensure that the project can adhere to the standards 
mandated by the Authority. 
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UID-enabled micro-payment architecture 

This section discusses one of the potential applications of the UID - the use of the number in 
driving financial inclusion, and in enabling a micropayments solution that the poor can use to 
access financial services. 

While the demand for financial inclusion has gained urgency over the last few years, initiatives in 
India to expand financial infrastructure date back several decades, since the building of rural 
cooperative credit banks in the 1950s, and the spread of bank networks in the 1970s and 1980s. 
These initiatives have paid off over the years — India's bank branches are well-networked, 
particularly across urban India. 

But despite these efforts, access to finance has remained scarce in rural India, and for the poorest 
residents in the country. Today, the proportion of rural residents who lack access to bank accounts 
remains at 40%, and this rises to over three-fifths of the population in the east and north-east of 
India. 

This exclusion is unfortunate. Economic opportunity is after all, intertwined with financial access. 
Such financial access is especially valuable for the poor — it offers a cushion to a group whose 
incomes are often volatile and small. It gives them opportunities to build savings, insure 
themselves against income shocks and make investments. Such savings and insurance protect the 
poor against potentially ruinous events — illness, loss of employment, droughts, and crop failures. 
However due to the lack of access to financial services, many of the Indian poor face difficulties in 
accumulating savings. 

To mitigate the lack of financial access in India, the RBI has focused on improving the reach of 
financial services in new and innovative ways — through no-frills accounts, the liberalization of 
banking and ATM policies, and branchless banking with business correspondents2 (BC), which 
enables local intermediaries such as self-help groups, post offices and kirana stores to provide 
banking services. These efforts have also included the promotion of core-banking solutions in 
regional rural banks; and the incorporation of the National Payment Corporation of India (NPCI) 
as an apex switch, for payments and settlements. 

In recent years, ATM and core banking, as well as greater mobile connectivity have also become 
two powerful engines of financial access. Mobile phones in particular present an enormous 
opportunity in spreading financial services across India. These technologies have reduced the 
need for banks to be physically close to their customers, and banks have been consequently able to 
experiment with providing services through online as well as mobile banking. These options, in 
addition to ATMs, have made banking accessible and affordable for many urban non-poor 
residents across the country. 





Unique Identification Authority of India 

Strategy Overview 


40 


With the poor however, banks face a fundamental challenge that limits the success of these 
technologies and recent banking innovations. The lack of clear identity documentation for the 
poor creates substantial difficulties in establishing their identity to banks. This has limited the 
extent to which we can leverage online and mobile banking to reach these communities. 

Besides challenges in access and identity, a third limitation has been the cost of providing banking 
services for the poor. The poor have unique preferences when it comes to withdrawing money and 
making deposits — they prefer to do large numbers of small transactions, in 'micropayments' of 
say, Rs.10 rather than Rs.100. Banks discourage such payments, as transaction costs under this 
model would be too high to bear. The Unique Identification number (UID), which identifies 
individuals uniquely on the basis of their demographic information and biometrics, gives 
individuals the means to clearly establish their identity to public and private agencies across the 
country. It also creates an opportunity to address the existing limitations in financial inclusion. 
The UID, once it's linked to a bank account, can help poor residents easily establish their identity to 
banking institutions. As a result, the UID enables banking institutions to bring together the 
infrastructure that now exists in order to build an accessible, low-cost micropayments model. 

Since the UID enables remote authentication of identity, it empowers the poor in making 
electronic transactions in small, micro-amounts, remotely and at low-cost, through BC networks 
connected by mobile phones. The model would thus be accessible and affordable across the 
country. Such a UID-enabled micropayments approach can bring about universal financial access 
for the poor — they would be able to access their accounts on the move, wherever they are, 
through any mobile phone, from any BC or bank. The UID-enabled bank account can thus be a 
global address for residents, similar to an email id or a mobile phone number. 

Over the last few years, we have seen critical reforms implemented towards creating a payments 
solution for the poor. The UID number helps integrate these reforms and leverage the technology 
already in place into an effective micropayments solution. This can bring low-cost access to 
financial services to everyone, a short distance from their homes. 

10.1 Features of UID-enabled micropayments 

UID KYR sufficient for KYC: Banks in India are required to follow customer identification 
procedures while opening new accounts, to reduce the risk of fraud and money laundering. The 
strong authentication that the UID offers, combined with its KYR standards, could remove the 
need for such individual KYC by banking institutions for basic, no-frills accounts. It will thus vastly 
reduce the documentation the poor are required to produce for a bank account, and significantly 
bring down KYC costs for banks. 

Electronic transactions: The UID's authentication processes will allow banking institutions to 
verify poor residents both in person and remotely. Rural residents will be able to transact 
electronically with each other as well as with individuals and firms outside the village, reducing 
their dependence on cash. 
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Ubiquitous BC network and BC choice: The UID's clear authentication and verification 
processes will allow banking institutions to network with village-based BCs such as self-help 
groups, post offices and kirana stores. Customers will be able to withdraw money and make 
deposits at the local BC. Multiple BCs at the local level will also give customers a choice of BCs. This 
would make customers, particularly in villages, less vulnerable to local power structures, and 
lower the risk of being exploited by BCs. 

A high-volume, low-cost revenue approach: The UID will mitigate the high customer 
acquisition costs, high transaction costs and fixed IT costs that we now face in bringing bank 
accounts to the poor. 

No-frills accounts that can be provided and accessed at low cost through local Bcs, with electronic 
cash transfers, would encourage large numbers of small transactions across these accounts, and 
make these accounts an important source of revenue for banks. 

10.2 Benefits 

For residents: The UID-enabled Bank Account [UEBA] will bring financial access and 
affordability to millions of residents who are presently excluded from formal financial systems. A 
UID-enabled bank account will also help residents make cheaper, faster electronic transactions 
and remittances in the form of micropayments. The solution will enable universal access to their 
account from any bank or BC, and through any mobile device, enabling residents to access 
payments on the move. Regular, affordable access to banking services would also give the poor a 
means of keeping their money safe — a convenience that has long been available to the middle 
class would nowbe accessible to the rural and urban poor. 

For the government: Large-scale financial inclusion can pave the way for electronic benefit 
transfers (EBTs) for residents. Central and state governments will be able to eliminate the 
identity-related fraud that exists within its public programs with such transfers going into UID- 
enabled bank accounts. The bulk of the informal cash economy across rural India, and remittances 
between urban and rural India will also become part of the formal banking system, with traceable 
and accountable money flows. This will ensure compliance with Anti-Money Laundering laws and 
Financial Action Task Force standards. The government will gain these benefits without having to 
overhaul governance systems — the micropayments approach won't require governments to 
change decision-making processes across the central, state and local level. 

For banking institutions: The use of the central payments switch to move cash electronically at 
the last mile will dramatically cut down on cash handling and transaction costs for banking 
institutions. The cost of customer acquisition would also be significantly reduced, as a resident 
with a UID would require no further identification to get a UID-enabled bank account. 

A low-cost micropayment approach will make the large volume of micropayments, remittances 
and government transfers to UID-enabled bank accounts important sources of revenue for 
banking institutions. Through the BC network, banks would be able to access customers through 
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the large distribution channels in the country — including the mobile prepaid network, post office 
network and FMCG retailers. In addition, BCs would see increased revenues from larger numbers 
of micro-transactions. 

10.3 Conclusion 

Over the last decade, we have seen a transformation in financial access for residents across the 
country — the reforms that encouraged the expansion of ATM, internet and mobile banking have 
made financial access affordable and accessible for large numbers of residents. 

The transformation however, has been most significant for India's urban, non-poor residents. 
These policies have not addressed the unique challenges the poor face in financial access, and they 
consequently, remain at the periphery when it comes to effective access to finance. 

The UID-enabled micropayments solution is just one of the many developmental applications that 
the U1D number can enable. It is also a critically important application, which can help address 
India's financial divide. Linking the U1D number to a universal, accessible, and affordable 
micropayments model can transform the access the poor have to banking services in the country. 

UID-enabled micropayments can be a stepping stone to creating economic opportunities for 
residents across the country, regardless of where they live. The financial inclusion that it makes 
possible will be critical to improving access for the poor to resources and skills. As we move 
towards an open access society, it is this soft infrastructure — connectivity, financial inclusion, and 
identity — that will ultimately, empower the individual in India. 







